understand

hisoka · March 10, 2015

I would like to know something . Suppose you guys Foxy Mod or Davej or Justsomeguy you get in collision with a JavaScript code like this

</script>

How will you be able to , perfectly , understand it and what it does in its details???

justsomeguy · March 10, 2015

Ideally you would get the original code instead of the minified packed code.

Ingolme · March 10, 2015

Usually when obtaining a third party library I read their documentation to figure out what it does. I don't actually read through minified code unless I'm reverse engineering something that the person didn't want to document.

hisoka · March 11, 2015

"Ideally you would get the original code instead of the minified packed code".

"I don't actually read through minified code"

In the context of JavaScript , the difference between the original code and the minified code is this

minified code = original code - unnecessary characters

original code = minified code + unnecessary characters

if the minified code is the original code minus unnecessary characters so there is no difference between the minified code and the original code . So why both of you would get and prefer the original code rather than the minified code ???

davej · March 11, 2015

Minified code is compressed and can also be obfuscated.

Try...

https://chrome.google.com/webstore/detail/pretty-beautiful-javascri/piekbefgpgdecckjcpffhnacjflfoddg?hl=en

justsomeguy · March 11, 2015

The code you posted is not only minified, it is also "packed" to replace all of the variable names with single-letter or short names.

hisoka · March 11, 2015

I look at this :

and this :

eval(function(p,a,c,k,e,d){e=function©{return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('b'+e©+'b','g'),k[c])}}return p}('1 g(){0 a=3.2["5"].f;4(a)}1 7(){0 b=3.2["6"];4(}1 8(){0 c=3.2["h"];4©}1 9(){0 d=3.2["e"];4(d)}',18,18,'var|function|forms|document|alert|form|log|show1|show2|show3|||||user|role|show|sys'.split('|'),0,{}))

both code are the same . Except that the second is an obfuscation of the first . Now and now I understand the trick . We really need the original code otherwise it will be a real ###### to understand such a code

hisoka · March 11, 2015

"I don't actually read through minified code unless I'm reverse engineering something that the person didn't want to document."

Please tell me , in the context of reverse engineering , if you want to reverse the very long and obfuscated code I gave above . How could you proceed ?

Should put this post in the general section ?`or it is ok to talk about it here?

justsomeguy · March 11, 2015

The first step would be to format it so it's readable. After that, I would go about replacing the shorter variable and function names with some of the things they replaced. If you can figure out generally what the algorithm is doing then you can guess on some variable names to help it make more sense.

hisoka · March 11, 2015

"The first step would be to format it so it's readable"

You mean you will deobfuscate it or unpack it ??

"you can guess on some variable names" "

I would go about replacing the shorter variable and function names with some of the things they replaced"

first why the need to guess the variable name if they can be of any name

for example :

var g = 12;

if you change g to b or c or x you get always the same result . So why changing the name of the variable and guessing it ? and the same with function

function read () {}

you can change the word read to any name you want still the function is the same and give the same result .

"If you can figure out generally what the algorithm is doing then you can guess on some variable names to help it make more sense"

how is it possible to figure out the algorithm in a complicated code even after getting the original code (which is impossible , you got only an approximation of the original code and not the original code) ? what are the tools and methods used to understand the algorithm ?

justsomeguy · March 11, 2015

You mean you will deobfuscate it or unpack it ??

No, I mean I would run it through a Javascript formatter to format the code.

So why changing the name of the variable and guessing it ?

So that the variable names make sense. I wouldn't change "g" to "c", I would change it to "num_completed" or "current_time" or "button_width" or something that makes sense according to whatever I think the code is trying to do.

what are the tools and methods used to understand the algorithm ?

It takes experience. You have to be able to follow the code and understand what it is doing.

hisoka · March 12, 2015

"No, I mean I would run it through a Javascript formatter to format the code."

but , in the context of reverse engineering, the code you will get is obfuscated and packed . So even if you beautify it and format it , it will serve you to nothing as you will never be able to understand it even when is formatted !!??

justsomeguy · March 12, 2015

If I am going to spend the time to try and figure out what the code is doing I'm not going to try and do that with a bunch of code on a single line. I'm at least going to format it so that it's easy to read. Why am I going to try and figure out what code on a single line is doing when I can format it? Which one of these is easier to figure out:

function shuffle(array){var counter=array.length,temp,index;while(counter>0){index=Math.floor(Math.random()*counter);counter--;temp=array[counter];array[counter]=array[index];array[index]=temp;}return array;}

function shuffle(array) {    var counter = array.length, temp, index;    while (counter > 0) {        index = Math.floor(Math.random() * counter);        counter--;        temp = array[counter];        array[counter] = array[index];        array[index] = temp;    }    return array;}

you will never be able to understand it even when is formatted !!??

Why not? I'm a good programmer, I can understand code. Meaningful variable names help, but they aren't necessary.

hisoka · March 13, 2015

first question:

You mean that if you find an obfuscated and packed code , you will unpack it and deobfuscate it then format it? is this what you mean?

second question :

when you try to understand a code that has million of lines . How/what will you do to understand it ? and the relationship between the different blocks in this million lines code , the relationship between the data in the line 250 and data in the line 2 million and how they interact together ?

justsomeguy · March 13, 2015

You mean that if you find an obfuscated and packed code , you will unpack it and deobfuscate it then format it? is this what you mean?

No. There is no program that can unpack and deobfuscate code. I format it first, then I read through it to figure out what it's doing and deobfuscate it myself.

second question :

It's the same process, it just takes longer. Personally, I've never found it to be a good use of time to try and do something like that. I would rather just design a program myself to do the same thing.

hisoka · March 14, 2015

"There is no program that can unpack and deobfuscate code"

What about this :

https://puzzlefiles.com/Deobfuscate/index.html

put this obfuscated script : (I obfuscated it here https://www.javascriptobfuscator.com/Javascript-Obfuscator.aspx)

and it will deobfuscate it

"It's the same process, it just takes longer. Personally, I've never found it to be a good use of time to try and do something like that. I would rather just design a program myself to do the same thing."

Does it mean that you cannot do it as it is a difficult process for you ?

justsomeguy · March 16, 2015

That's not much of an obfuscated script. Go back up to the shuffle function I posted above. It starts like this:

function shuffle(array) {    var counter = array.length, temp, index;    while (counter > 0) {        index = Math.floor(Math.random() * counter);        counter--;        temp = array[counter];        array[counter] = array[index];        array[index] = temp;    }    return array;}

When you pack it, you get this:

function shuffle(r){for(var f,n,o=r.length;o>0;)n=Math.floor(Math.random()*o),o--,f=r[o],r[o]=r[n],r[n]=f;return r}

Using your link to "de-obfuscate" it results in this:

function shuffle(r) {    for (var f, n, o = r.length; o > 0;) n = Math.floor(Math.random() * o), o--, f = r[o], r[o] = r[n], r[n] = f;    return r}

Notice how it is not the same as the original code. Information from the original code (variable names, comments, etc) is lost when packing the code and there is no program to get that back. The code that you showed that is supposed to be obfuscated is just code where they replaced various strings with hex code equivalents, that's not much obfuscation. It's still easy to tell what your code does. This is what obfuscated code looks like (written in C):

#include "SDL.h"#define $ for(O=9#define CX M+=(T%3+2*!(!T*t-6))#define x ,A=4*!T,O=t,W=h=T<3?u(Q?p:D(A+3),D(A),D(A+1)[i]+D(A+2)*g+):K(t),U=V=K(a),o?U=h,W=V:V,#define C 8*-~L#define Z short#define y a(Z)Y[++O]#define B ),a--||(#define _ ),e--||(#define V(I,D,E)(O=a(I)h[r])&&!(A=(D)(V=(1[E+L]<<16)+*i)/O,A-(I)A)?1[E+L]=V-O*(*E=A):H(0)#define i(B,M)B(o){return M;}#define R(O,M,_)(S=L?a(I Z)O:O,N=L?a(I Z)O M(f=a(I Z)_):(O M(f=a(I n)_)))#define T(_)R(r[u(10,L=4,--)],=,_)#define u(a,r,T)16*i[a]+(I Z)(T i[r])#define a(_)*(_*)define L(_)M(W,_,U)#define M(S,F,T)R(r[S],F,r[T])#define A(_)(i[L=4]+=2,R(_,=,r[u(10,4,-2+)]))#define c(R,T)(1[u=19,L+T]=(N=a(R)h[r]*(R)*T)>>16,*i=N,G(F(N-(R)N)))#define h(_)(1&(L?a(Z)_:_)>>C-1)#define I unsigned#define n char#define e(_)v(F(40[L(_##=40[E]+),E]&N==S|_ N<_(int)S))I n t,e,l[80186],*E,m,u,L,a,T,o,r[1<<21],X,*Y,b,Q,R;I Z*i,M,p,q=3;I*localtime(),f,S,kb,h,W,U,c,g,d,V,A;N,O,P=983040,j[5];SDL_Surface*k;i(F,40[E]=!!o)i(z,42[E]=!!o)i(D,r[a(I)E[259+4*o]+O])i(w,i[o]+=~(-2*47[E])*~L)i(v,G(N-S&&1&(40[z((f^=S^N)&16),E]^f>>C-1)))J(){V=61442;$;O--;)V+=40[E+O]<<D(25);}i(H,(46[u=76,J(),T(V),T(9[i]),T(M),M(P+18,=,4*o+2),R(M,=,r[4*o]),E]=0))s(o){$;O--;)40[E+O]=1&&1<<D(25)&o;}i(BP,(*i+=262*o*z(F((*E&15)>9|42[E])),*E&=15))i(SP,(w(7),R&&--1[i]&&o?R++,Q&&Q++,M--:0))DX(){$,O*=27840;O--;)O[(I*)k->pixels]=-!!(1<<7-O%8&r[O/2880*90+O%720/8+(88+952[l]/128*4+O/720%4<<13)]);SDL_Flip(k);}main(BX,nE)n**nE;{9[i=E=r+P]=P>>4;$;q;)j[--q]=*++nE?open(*nE,32898):0;read(2[a(I)*i=*j?lseek(*j,0,2)>>9:0,j],E+(M=256),P);$;Y=r+16*9[i]+M,Y-r;Q|R||kb&46[E]&&KB)--64[T=1[O=32[L=(X=*Y&7)&1,o=X/2&1,l]=0,t=(c=y)&7,a=c/8&7,Y]>>6,g=~-T?y:(n)y,d=BX=y,l],!T*t-6&&T-2?T-1?d=g:0:(d=y),Q&&Q--,R&&R--x(O=*Y,O=u=D(51),e=D(8),m=D(14)_ O=*Y/2&7,M+=(n)c*(L^(D(m)[E]|D(22)[E]|D(23)[E]^D(24)[E]))_ L=*Y&8,R(K(X)[r],=,c)_ L=e+=3,o=0,a=X x a=m _ T(X[i])_ A(X[i])_ a<2?M(U,+=1-2*a+,P+24),v(f=1),G(S+1-a==1<<C-1),u=u&4?19:57:a-6?CX+2,a-3||T(9[i]),a&2&&T(M),a&1&&M(P+18,=,U+2),R(M,=,U[r]),u=67:T(h[r])_(W=U B u=m,M-=~L,R(W[r],&,d)B 0 B L(=~)B L(=-),S=0,u=22,F(N>S)B L?c(I Z,i):c(I n,E)B/**/L?c(Z,i):c(n,E)B L?V(I Z,I,i):V(I n,I Z,E)B L?V(Z,int,i):V(n,Z,E))_++e,h=P,d=c,T=3,a=m,M--_++e,13[W=h,i]=(o|=!L)?(n)d:d,U=P+26,M-=~!o,u=17+(m=a)_(a=m B L(+=),F(N<S)B L(|=)B e(+)B e(-)B L(&=)B L(-=),F(N>S)B L(^=)B L(-),F(N>S)B L(=))_!L?L=a+=8 x L(=):!o?Q=1,R(r[p=m x V],=,h):A(h[r])_ T=a=0,t=6,g=c x M(U,=,W)_(A=h(h[r]),V=m?++M,(n)g:o?31&2[E]:1)&&(a<4?V%=a/2+C,R(A,=,h[r]):0,a&1?R(h[r],>>=,V):R(h[r],<<=,V),a>3?u=19:0,a<5?0:F(S>>V-1&1)B R(h[r],+=,A>>C-V),G(h(N)^F(N&1))B A&=(1<<V)-1,R(h[r],+=,A<<C-V),G(h(N*2)^F(h(N)))B R(h[r],+=(40[E]<<V-1)+,A>>1+C-V),G(h(N)^F(A&1<<C-V))B R(h[r],+=(40[E]<<C-V)+,A<<1+C-V),F(A&1<<V-1),G(h(N)^h(N*2))B G(h(N)^F(h(S<<V-1)))B G(h(S))B 0 B V<C||F(A),G(0),R(h[r],+=,A*=~((1<<C)-1>>V)))_(V=!!--1[a=X,i]B V&=!m[E]B V&=m[E]B 0 B V=!++1[i]),M+=V*(n)c _ M+=3-o,L?0:o?9[M=0,i]=BX:T(M),M+=o*L?(n)c:c _ M(U,&,W)_ L=e+=8,W=P,U=K(X)_!R||1[i]?M(m<2?u(8,7,),=,m&1?P:u(Q?p:11,6,)),m&1||w(6),m&2||SP(1):0 _!R||1[i]?M(m?P:u(Q?p:11,6,),-,u(8,7,)),43[u=92,E]=!N,F(N>S),m||w(6),SP(!N==:0 _ o=L,A(M),m&&A(9[i]),m&2?s(A(V))||(4[i]+=c)_ R(U[r],=,d)_ 986[l]^=9,R(*E,=,l[m?2[i]:(n)c])_ R(l[m?2[i]:(n)c],=,*E)_ R=2,b=L,Q&&Q++_ W-U?L(^=),M(U,^=,W),L(^=):0 _ T(m[i])_ A(m[i])_ Q=2,p=m,R&&R++_ L=0,O=*E,F(D(m+=3*42[E]+6*40[E])),z(D(1+m)),N=*E=D(m-1)_ N=BP(m-1)_ 1[E]=-h(*E)_ 2[i]=-h(*i)_ 9[T(9[i]),T(M+5),i]=BX,M=c _ J(),T(V)_ s(A(V))_ J(),s((V&~m)+1[E])_ J(),1[E]=V _ L=o=1 x L(=),M(P+m,=,h+2)_++M,H(3)_ M+=2,H(c&m)_++M,m[E]&&H(4)_(c&=m)?1[E]=*E/c,N=*E%=c:H(0)_*i=N=m&E[L=0]+c*1[E]_*E=-m[E]_*E=r[u(Q?p:m,3,*E+)]_ m[E]^=1 _ E[m/2]=m&1 _ R(*E,&,c)_(a=c B write(1,E,1)B time(j+3),memcpy(r+u(8,3,),localtime(j+3),m)),a<2?*E=~lseek(O=4[E][j],a(I)5[i]<<9,0)?((I(*)())(a?write:read))(O,r+u(8,3,),*i):0:0),O=u,D(16)?v(0)(17)&&G(F(0)),CX*D(20)+D(18)-D(19)*~!!L,D(15)?O=m=N,41[43[44[E]=h(N),E]=!N,E]=D(50):0,!++q?kb=1,*l?SDL_PumpEvents(),k=k?k:SDL_SetVideoMode(720,348,32,0),DX():k?SDL_Quit(),k=0:0:0;}i(G,48[E]=o)i(K,P+(L?2*o:2*o+o/4&7))

Notice all of the single-letter variable names. Obfuscation is not as simple as just replacing some strings with a series of hex codes.

Does it mean that you cannot do it as it is a difficult process for you ?

No, it means that I better have a really good reason to try and figure it out if I'm going to spend that much time on it.

understand

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Create an account or sign in to comment

Create an account

Sign in